Repository navigation
Kafka gateway: Kafka SASL authentication bridge to Iggy users #3549
Description
Part of #3560.
Summary
Map Kafka SaslHandshake (17) and SaslAuthenticate (36) to Iggy authentication.
Open question (from discussion #3253)
- One-to-one SASL user → Iggy user mapping?
- Or shared
kafka-bridgeservice account?
Depends on
- Kafka gateway: Kafka gateway Phase 1 — docker-compose, E2E tests, and quick-start docs #3539 — Phase 1
Scope
- Document chosen auth model in ADR
- PLAIN / SCRAM (prioritize what Iggy supports)
- Map authenticated identity to Iggy SDK login
- ACL mapping to Iggy permissions (may split follow-up)
Acceptance criteria
- Kafka client with SASL can produce/consume through gateway
- Unauthorized credentials rejected with Kafka error codes
Activity
[-]feat(gateways): Kafka SASL authentication bridge to Iggy users[/-][+]Kafka gateway: Kafka SASL authentication bridge to Iggy users[/+]numinnex commentedon Sep 17, 2026
I am picking it up.
ryerraguntla commentedon Sep 17, 2026
numinnex commentedon Sep 17, 2026
#4222 resolves
numinnex commentedon Sep 29, 2026
The last criterion, a SASL client producing and consuming through the gateway, needs Fetch from #4336 and moves to #4340.
numinnex commentedon Oct 21, 2026
Closing this one as #4320 was the last missing piece.
feat(gateways): serve SASL SCRAM-SHA-256/512 and OAUTHBEARER on the K…